GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — doc: clarify HTTP/1.1 response ordering · nodejs/node@20ce359

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

SECURITY.md
doc/api
- http.md

Expand file treeCollapse file tree

Open diff view settings

Collapse file

`‎SECURITY.md‎`

Copy file name to clipboardExpand all lines: SECURITY.md

+8Lines changed: 8 additions & 0 deletions

Display the source diff
Display the rich diff

Original file line number	Diff line number	Diff line change
`@@ -293,6 +293,14 @@ the community they pose.`
`293`	`293`	`* Defense-in-depth issues are never treated as Node.js security vulnerabilities,`
`294`	`294`	`do not receive CVEs, and are handled as regular bugs or hardening improvements.`
`295`	`295`
	`296`	`+#### Malicious protocol peers`
	`297`	`+`
	`298`	`+* Node.js treats data from remote network peers as untrusted, and bugs in`
	`299`	`+ parsers or protocol implementations may be security vulnerabilities.`
	`300`	`+* Node.js treats data from HTTP/1.1 keep-alive connections as trusted, meaning that a Node.js`
	`301`	`+ client consuming unsolicited or misordered responses within the same HTTP/1.1 connection`
	`302`	`+ reuse lifecycle are generally not considered Node.js vulnerabilities.`
	`303`	`+`
`296`	`304`	`#### Malicious Third-Party Modules (CWE-1357)`
`297`	`305`
`298`	`306`	`* Code is trusted by Node.js. Therefore any scenario that requires a malicious`

Collapse file

`‎doc/api/http.md‎`

Copy file name to clipboardExpand all lines: doc/api/http.md

+10Lines changed: 10 additions & 0 deletions

Display the source diff
Display the rich diff

Original file line number	Diff line number	Diff line change
`@@ -70,6 +70,14 @@ over the same connection, in which case the connection will have to be`
`70`	`70`	remade for every request and cannot be pooled. The `Agent` will still make
`71`	`71`	`the requests to that server, but each one will occur over a new connection.`
`72`	`72`
	`73`	`+### Response ordering with connection reuse`
	`74`	`+`
	`75`	`+On a reused HTTP/1.1 keep-alive connection, responses are associated with`
	`76`	`+requests by their order on that connection. HTTP/1.1 keep-alive does not provide`
	`77`	`+per-request response attribution beyond that ordering. Applications that require`
	`78`	+per-request connection isolation can use a separate `Agent`, disable keep-alive,
	`79`	+or pass `agent: false`.
	`80`	`+`
`73`	`81`	`When a connection is closed by the client or the server, it is removed`
`74`	`82`	`from the pool. Any unused sockets in the pool will be unrefed so as not`
`75`	`83`	`to keep the Node.js process running when there are no outstanding requests.`
`@@ -109,6 +117,8 @@ http.get({`
`109`	`117`	`});`
`110`	`118`	```
`111`	`119`
	`120`	+Use `agent: false` to avoid connection reuse for a request.
	`121`	`+`
`112`	`122`	### `new Agent([options])`
`113`	`123`
`114`	`124`	`<!-- YAML`

0 commit comments

Comments

0 (0)

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.